Data Transfer Policy London Borough of Barnet

Transcription

1 London Borough of Barnet DATA PROTECTION 11

2 Document Control Document Description Data Transfer Policy Version v.2 Date Created December 2010 Status Authorisation Name Signature Date Prepared By: IS Checked By Version Control Version number Date Author Reason for New Version V.1 Dec 2010 XXXXXX New Policy V.1.2 Dec 2012 XXXXXX Review No change V.2 Apr 2014 XXXXXX Review Date last reviewed: April 2014 Date of next review: April

3 CONTENTS PAGE 1 Introduction Purpose & scope Initial considerations Data transfer methods Via Via standard Via GCSx Via Encrypt and Send Transfer of Electronic data via the internet using File Transfer Protocol (FTP & Secure FTP) Removable storage devices (CD, DVD, Floppy, USB drive, Memory Card) Fax transmission Telephone / mobile phone Internet based collaborative sites Sending by post Use of Internal Mail Transferring data outside of the United Kingdom / EEA What is a Transfer? Countries in the EEA Reporting data breaches Contact information

4 1 Introduction There are many occasions when transfer of council data is required between internal departments, third party service providers, public bodies, commercial organisations and individuals to perform business functions. If the information is personal or sensitive personal data as defined by the Data Protection Act 1998 (DPA) or considered business confidential it is essential that the transfer is performed in a way that adequately protects the information. In this policy the data above is called controlled data. The DPA regulates the use of personal or sensitive personal information and list 8 Principles that must be followed when handling personal data. The actions required to meet these principles are covered in this policy. The data can potentially be transferred in a wide variety of media and methods, in electronic and/or paper format and in every transfer there is a risk that the information may be lost, misappropriated or accidentally released. This is a danger to the individual whose information is being sent. It also puts the council at risk of breaching our responsibilities under the DPA and could lead to regulatory action, including fines. 2 Purpose & scope This policy lays out the practical methods that need to be applied in undertaking a transfer of controlled data. This policy covers all circumstances where personal, sensitive personal or business confidential information (paper and electronic) is taken outside of its normally secure location. This policy is applicable to anyone handling council information who may have a need to transfer council data, including: employees of the council contractors agency staff Councillors handling council information contractual third party suppliers agents and partners of the council. 3 Initial considerations You, as the person transferring the data, must ensure that there is appropriate authorisation to send the confidential or sensitive personal data to the requester and that the transfer is legal and appropriate under the DPA. 3

5 Ask why the data needs to be transferred. What is the purpose of the request? Is there a legal requirement? Is the data required for recognised audit inspection? Is it for an on-going project? If you are in doubt over what can or can t be disclosed in line with the requirements of the Data Protection Act 1998 you should refer to the council s Data Protection Policy and seek further advice from the Information Management Team. Never assume someone is entitled to the information just because they have told you they are, regardless of whether they are an internal or external requester. When dealing with third parties are there any data sharing agreements or contracts in place that cover the transfer of data? Is a Non-Disclosure Agreement required to cover security and use of the data? Check that you are not providing more information than is necessary for the identified purpose. Can the objective / purpose be met using anonymised data instead? Consider the most appropriate (not necessarily the easiest) transfer or access method. What risk does the transfer or access to information pose (if any)? For all transfers of information containing controlled data, it is essential that you appropriately establish the identity and authorisation of the recipient. 4 Data transfer methods Before choosing your method of transferring / sending information you must consider the following: the nature of the information, its sensitivity, confidentiality or possible value the damage or distress that may be caused to individuals as a result of any loss or misuse of the data the effect the loss would have on the council The size of the data being transferred You must only send information that is necessary for the purpose. No unnecessary data should be included, even if it is more convenient. Only sufficient data should be copied for the agreed purpose. This section lists the main methods and sets out any restrictions and requirements for secure transfer of controlled data. 4

6 4.1 Via There are 3 main routes that can be considered when transferring data. These are outlined below, with relevant restrictions highlighted. All transfers of data by must be done in a way that complies with the council s Acceptable Use Policy. Which states: Sensitive Personal Data (as defined by the Data Protection Act 1998) and highly confidential information when sent externally must only be sent via secure such as GCSx or Encrypt and Send. Users are responsible for considering the sensitivity of data in an before they send it and choosing the most appropriate method of transfer. General rules The file size of an is restricted to 30Mb, therefore, if you are sending large volumes of data, that are likely to exceed your systems capacity, you should consider an alternative transfer method as explained in paragraph 4.5 below. should not to be used for transfer of large amounts of data or significant numbers of records. messages must contain clear instructions on the recipient s responsibilities and instructions on what to do if they are not the correct recipient. Information sent must, where practical be enclosed in an attachment and the and / or the attachment encrypted using the councils approved products and the Encrypt and Send mail system. 4.2 Via standard When sending information internally between barnet.gov.uk addresses, this is secure and does not require any additional actions, as the information being sent is not leaving the Barnet network. However, using your Barnet account to send information to a non-barnet address (i.e. something other is not as secure and should not be used for controlled data. If you do wish to apply an extra level of security you can apply a password to an encrypted attachment. Please ensure: All password(s) assigned to encrypted documents must conform to the corporate Password Policy All password(s) required to open the encrypted attached file must be transferred separately to the recipient either via a telephone call to an 5

7 agreed number, or via a separate following confirmation of safe receipt. Be careful as to what information you place in the subject line of your or in the accompanying message. Filename or subject line must not reveal the contents of the encrypted file. 4.3 Via GCSx GCSx is a security assured network between public bodies, local authorities, Health, Police, Criminal Justice and other PSN (Public Sector Network) connected organisations. If you have a GCSx account in Outlook it is possible to send information securely by without any additional security providing that the recipient also has a secure network address. An account can be requested from IS self-service. GCSx accounts should be used when sending sensitive personal data or information you consider to be highly confidential. Users of GCSx accounts must ensure they comply with the council s Protective Marking for GCSx s Policy before use. GCSx users can only send to other users who are registered on the secure PSN network. If you attempt to send from your GCSx account to a user not on the secure network, your will be rejected and you ll receive an error notification. Encryption or password protection of the document prior to transfer is not required if you are using GCSx because the network is inherently secure and encrypted files are blocked by the PSN infrastructure. 4.4 Via Encrypt and Send Encrypt and Send is a method of ing information in a secure manner; protecting the content and attachment against unauthorised access. s sent using Encrypt and Send are not sent directly to an address they are stored on a Secure Message Server which protects the sensitive information against unauthorised access. The recipient needs to undertake an initial registration in order to be able to send and receive in this way. Encrypt and Send should be used when: (a) Sending sensitive business and personal information via to an individual or organisation outside of the London Borough of Barnet s secure network; and 6

8 (b) If you cannot use the GCSx secure method. It should not be used if GCSx is available. Users should refer to the Encrypt and Send Guide for Internal Users and the Encrypt & Send Secure Message Centre Guide (for external users) 4.5 Transfer of Electronic data via the internet using File Transfer Protocol (FTP & Secure FTP) The File Transfer Protocol (FTP) is a standard network tool used to transfer computer files from one host to another over a TCP-based network, such as the Internet. Standard FTP without encryption is inherently insecure and must not be used for transmitting any data, especially personal, sensitive or confidential information. Secure FTP (SFTP) uses the Secure Shell protocol (SSH) to transfer files. Unlike FTP, SFTP encrypts both commands and data, preventing passwords and sensitive information from being transmitted openly over the network. SFTP file transfers are acceptable. This should be arranged via Barnet IS department. It is the responsibility of the sender to ensure that the use of such a system is appropriate for the use they propose. If in doubt, seek advice from the IS Security Manager, dennis.hunt@barnet.gov.uk 4.6 Removable storage devices (CD, DVD, Floppy, USB drive, Memory Card) When the size of the data being transferred or other restrictions (such as nonavailability of SFTP) make transfer methods inappropriate, removable media should be used to transfer data. In those circumstances, where exception has been approved and authorised by an Assistance Director or Head of Service, the following arrangements must be followed: The media used to perform Encryption must conform to the AES 256 standard. If it is required to write data to removable media this should be done by IS. Where a removable/portable storage device is used, copying should be undertaken by IS. 7

9 All removable or portable storage devices used for data transfer must be encrypted by IS to AES 256 standards. Ownership of the media used must be established. The media must be returned to the owner on completion of the transfer and the transferred data must be securely erased. Encrypted portable storage devices must then be password protected with a strong password as set out in the council s Password Policy. The password itself must be conveyed to the third party in a separate communication from that covering the controlled data itself. When the data is delivered to the third party, a receipt must be obtained. You should provide clear instructions on the recipient s responsibilities, and instructions on what to do if they are not the intended recipient. An accompanying message or filename must not reveal the contents of the encrypted file. The sender must check at an appropriate time that the transfer has been successful, and report any issues to their line manager and in the case of missing or corrupt data to IS. 4.7 Fax transmission Fax machines are inherently insecure and are not recommended for transfer of controlled data. However, it is acknowledged that in certain circumstances it is unavoidable. You must ensure that the following is covered for any fax transmission of controlled data: You must check that the fax number is correct and that the receiver is actively expecting and waiting for transmission. You should check the number before sending. For high sensitivity information the number must be double-checked by a colleague before transmission, and telephone contact should be maintained throughout transmission. Both sender and receiver must have an agreed process to avoid their copy being left on the fax machine. Both are required to securely destroy the message when it is no longer required and you must ensure that the recipient is aware of this requirement. You must ensure that you have given the recipient clear instructions on their responsibilities and instructions on what to do if they are not the correct recipient. You must check that the transfer has been successful, and report any issues to your line manager. 8

10 The council also has the ability to use the IceTrack fax system to send and receive fax transmissions. This system converts fax transmissions to to transmit and receive and is more secure in use than a fax machine. However the receiving location may still have a traditional fax machine so when using IceTrack correct practice must still be followed. 4.8 Telephone / mobile phone As phone calls may be monitored, overheard or intercepted either deliberately or accidentally, care must be taken as follows. Controlled data must not be transferred over the telephone unless you have confirmed the identity and authorisation of the recipient. When using answer phones do not leave sensitive or confidential messages for other people, only provide a means of contact and not any personal details. When listening to answer phone messages left for yourself, ensure you do not play them in open plan areas which risks others overhearing. 4.9 Internet based collaborative sites The use of peer to peer (P2P) or cloud file sharing programs such as Dropbox, Google Docs, Office 365 to exchange files over the internet is not permitted. They are inherently insecure if not implemented in a secured corporate environment. Where you believe you have a requirement to use this type of program you must speak with the IS Security Manager who will provide appropriate advice Sending by post As a local authority we will routinely send letters to our customers containing personal information. For example, in connection with council tax or benefit claims. However, whilst this is routine, care must still be taken to ensure that the information is correctly addressed to a named recipient and information is not sent in error to the wrong recipient. Mail going to the wrong person is a danger to the individual whose information is being sent. It also puts the council at risk of breaching our responsibilities under the DPA. You, as the sender are responsible for making sure that: the postal address is correct. the envelope is clearly marked for the attention of the intended recipient. no information relating to another customer / service user has been included in error, either in a letter/ or an attached document. 9

11 You are responsible for the package up until its successful arrival at its destination. You must therefore ensure you choose the most appropriate method of transfer and mitigate any potential loss. Posting of sensitive / confidential data Where information consists of sensitive personal data (as defined by the DPA), or is considered highly business confidential, an extra level of protection should be applied and the following measures should be adopted: It is essential that the document or file, whether sent on a media device or in paper form, is kept secure in transit, tracked during transit, and delivered to the correct individual. So you must ensure that: the package is securely and appropriately packed, clearly addressed and have a seal, which must be broken to open the package. the package must have a return address and contact details. the package(s) must be received and signed for by the addressee, e.g. the use of special or recorded delivery. Successful delivery / transfer of the item must be checked as soon as possible. Any issues must be reported immediately to your line manager Use of Internal Mail Post sent through the internal mail system must be clearly addressed to the intended recipient. Files or documents containing controlled data must not be transferred loose and should be appropriately packaged, in a sealed envelope, to avoid disclosure to others or loss of information. Personal data must not be passed from one department to another when anonymised or statistical information would be sufficient. Any information transferred must be relevant and be the minimum necessary for a specific purpose. If information is deemed reasonably high risk if lost or mislaid, where possible this should be hand delivered to the recipient department. 5 Transferring data outside of the United Kingdom / EEA You must speak to the corporate Information Management Team before agreeing or undertaking any transfers of controlled data outside of the EEA. This applies to personal and sensitive personal data but may still be relevant to business confidential information. 10

12 It is necessary to have a contract in place when using subcontractors abroad who will have access to personal data. Principle Eight of the Data Protection Act 1998 (DPA), requires that personal data must not be transferred to a country or territory outside the European Economic Area (EEA) unless the country or territory can provide an adequate level of protection for the rights and freedoms of the individuals whose data is being transferred. It is important to note that other principles of the Data Protection Act are still relevant. In particular, the council must comply with the seventh principle, in that the information must be sent in a secure manner. 5.1 What is a Transfer? A transfer involves sending personal data to someone in another country, whether via paper or electronic means. A transfer is not the same as the transit of information though a country. The eighth principle will only apply if the information moves to a country, rather than simply passing through it on route to its destination. You will be processing personal data in the UK and transferring it even if: you collect information relating to individuals on paper, which is not ordered or structured in any way; and you send this overseas with the intention that once it is there it will be processed using equipment operating automatically; or it will be added it to a highly structured filing system relating to individuals. The transfers will take place when someone outside the EEA accesses the website. If you load information onto a server based in the UK so that it can be accessed through a website, you should consider the likelihood that a transfer may take place and whether that would be fair for the individuals concerned. If you intend information on the website to be accessed outside the EEA, then this is a transfer. Before making a transfer. you should consider whether you can achieve your aims without actually processing personal data. For example, if data is made anonymous so that it is not possible to identify individuals from it, now or at any point in the future, then the data protection principles will not apply and you are free to transfer the information outside the EEA. The information below has been taken from guidance provided by the Information Commissioners Office (ICO). 11

13 5.2 Countries in the EEA The following countries are all in the EEA and are therefore safe to transfer to. You must still however ensure that the transfer meets the requirements of the DPA in terms of the other principles. Austria Belgium Bulgaria Croatia Cyprus Czech Republic Denmark Estonia Finland France Germany Greece Hungary Iceland Ireland Italy Latvia Liechtenstein Lithuania Luxembourg Malta Netherlands Norway Poland Portugal Romania Slovakia Slovenia Spain Sweden The European Commission has further decided that certain countries have an adequate level of protection for personal data. Currently, the following countries are considered as having adequate protection. Andorra Argentina Australia Canada Faroe Islands Guernsey Isle of Man Israel Jersey New Zealand Switzerland Uruguay These lists are subject to additions and you should always refer to the European Commission s data protection website for an up-to-date list. Other permitted circumstances also include: Data is transferred to a company in the United States which has signed up to the 'Safe Harbour' agreement (a set of rules similar to those found in the UK's data protection law). The transfer is made under a contract which includes the model clauses adopted by the European Commission (EC) to ensure that there will be adequate safeguards for data transferred to a source outside the EEA. Template model clauses can be found on the European Commission s data protection website. There are a limited number of exemptions that may apply where you can transfer data to other countries. 12

14 Remember, for any transfer outside the EEA, including to countries listed above as safe, you must speak to the Information Management Team before agreeing or undertaking any transfers of controlled data. 6 Reporting data breaches Staff must report any suspected or actual security breaches related to data transfer in line with the council s Security & Data Protection Incident Management Policy. 7 Contact information Further advice and guidance on transfer methods is available from the service desk ITService.desk@barnet.gov.uk Tel: (020) or dial ext: 3333 If you are in any doubt whether a transfer can be undertaken in line with the Data Protection Act, please seek advice from the Information Management Team. data.protection@barnet.gov.uk Tel: (020) or dial ext: